Reporter Reliability Scoring for Malicious Content Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyberthreat protection systems face inefficiencies in resource allocation due to varying user reliability in reporting unwanted emails, leading to wasted resources on evaluating non-malicious messages.
Innovation Solution
A system that scores users based on their reporting reliability, prioritizing messages from highly reliable users for initial evaluation and reevaluation, and using a reevaluation queue with delayed analysis to update message status with new data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all reported unwanted messages are evaluated regardless of reporter reliability, then comprehensive threat detection is achieved, but resources are wasted on messages from unreliable reporters
Solution Approach 1:
The system applies different evaluation priorities to different messages based on the local quality (reliability score) of their reporters. Messages from high-reliability reporters are prioritized for immediate evaluation, while messages from low-reliability reporters are deprioritized or placed in a reevaluation queue, optimizing resource allocation according to the specific characteristics of each reporting instance.
Solution Approach 2:
The system changes the evaluation parameter (priority level) based on the reporter's reliability score. By dynamically adjusting the evaluation priority from high to low depending on the reporter's historical accuracy, the system optimizes resource usage while maintaining comprehensive threat detection capability.
2Reliability
If messages from unreliable reporters are evaluated immediately, then potential threats are not missed, but evaluation resources are inefficiently used
Solution Approach 1:
The system performs preliminary assessment of reporter reliability before full message evaluation. By pre-calculating and storing reliability scores based on historical reporting accuracy, the system can quickly determine evaluation priority without compromising threat detection completeness, thereby improving overall evaluation efficiency.
Solution Approach 2:
The system applies partial evaluation action based on reporter reliability. For low-reliability reporters, messages may be placed in a reevaluation queue for later processing rather than immediate full evaluation, while still ensuring they are not completely ignored. This partial action approach maintains detection completeness while optimizing resource efficiency.
3Productivity
If reliable reporters are prioritized in message evaluation, then resource efficiency improves, but messages from unreliable reporters may be missed
Solution Approach 1:
The system implements dynamic message prioritization that adapts to each message's specific context. Rather than statically ignoring messages from unreliable reporters, the system dynamically adjusts evaluation timing and priority based on reporter reliability scores, allowing flexible resource allocation that maintains detection accuracy while improving efficiency.
Solution Approach 2:
The system implements periodic reevaluation of messages from the reevaluation queue. Messages from unreliable reporters are not permanently discarded but are periodically reevaluated at lower priority, ensuring that potential threats are eventually detected while optimizing immediate resource utilization for higher-priority messages.
Data Source
AI summary
Systems, methods and products for increasing efficiency of resource usage by determining the reliability of reporters of unwanted messages and prioritizing evaluation of messages based on the reliability scores. Reports of unwanted messages are evaluated to determine whether they are bad. If an unwanted message is bad, a score for the reporter is updated to reflect a positive credit. A set of safe rules are applied to the message to determine whether it is safe and if the message is determined to be safe, the reporter score corresponding to the reporter is updated to reflect a non-positive (zero or negative) credit. If the message is determined to be neither bad nor safe, the message is entered in a reevaluation queue and, after a waiting period, the message evaluation is repeated using updated threat information, and the reporter score is updated according to the reevaluation.